1. Field
The present inventive concept relates to a system and method to detect and contain threatening executable code. More specifically, an embodiment of the present inventive concept relates to a system and method operable to improve identification and containment of threatening software across a plurality of endpoints.
2. Discussion of Related Art
Systems currently exist to detect executable code as it passes over a network. These systems employ a variety of methods of detection, including analyzing traffic at various protocol and application layers as well as analyzing common application artifacts such as email messages. These systems can analyze executable code using a variety of methods to extract information about the code's behavior. Existing systems use the extracted information to classify the code as benign or a potential threat.
While such existing systems may be effective at identifying threats represented by executable code in network traffic, they are not suitable to identify devices or users that may have been exposed to the threat. For example, existing systems and methods cannot conclusively determine if a threat or piece of code has reached a device on which it could be executed or, once such a threat or piece of code has reached such a device, whether or not it has actually executed.
Further, analysis of information and data traffic and application artifacts, and generation of information therefrom, takes time. During the process of analysis, there is a risk that a threatening piece of code may be transmitted to, received by, and potentially executed on a device. Even if a security investigator using existing systems can successfully determine that a threat has landed or executed, intervention against the threat using existing systems and methods must be performed manually or by channels outside the normal network, sometimes requiring physical access to the device, thus further extending the time between initiating analysis and effectively reacting to discovery of a threat. During the time it takes to implement existing systems and methods to detect, control or contain threatening software, such threatening software may be allowed to further its malicious functions.
Thus, there is a need for a system and method that provides improved detection, verification, tracking and reaction to threatening software.